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1. {Currently Amended) A system, comprising: 

a pan of collector devices * arc disposed to coAeyAcm^^ 
identi fy host connection pairs vrom ^e^H»tsfeto^^^^ p . ' e m -i arc - 
between nodes on a network; and 

plurality of collector devices, and which produces a connection i. bit ;u aps eat 5 iode on the 
neiwodc to a record that stores information about traffic to or .from, the node, 

2, (Currentiv o n < d 1 he .system id mi 1 wherein h ipprep.;s;a determines atjeast 
m I a i a s >je^ earn ofn 

events. 

v ia i m of cl nm 2 \ emprise 

,i proees ! 

, MH ^^^^ 

4, (Cnner ir VnmkLv s F u- fur (t dam I w I rem ta. 1;c ljo, de\*>„e juhIks 
comprises: 
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\ ^ ;« 

in the network. 

(Cm deed system of elu 4j.\ herein t 

itacks 

7, (Currently Amended) The system of claim 4- 4_\vherein the » > i n <- include 
1 i 4ft 5 m .0 a. e j > ot r propagation. 

8. (Original! i he msiem of claim 1 wherein the eoimecti on table includes a plurality of 
records that are indexed by source address. 

1 ( system of clai herein the e< > e m d > S 

t' e xed by desti lath address 

10, (Original) The system of claim I wherein the connection table includes a plurality of 
records thai are indexed by time. 

1 < n I i w i n < s i >s no! In ^ j ^ 1 t , S « » d ^ c 

$v it ■> . h ( \ i k« vh sanation address aa4 time. 

id t<\ m > i I a 1 ^ tur nT e. t Cu mi tem: u! ■> e r kT' o 

^ >" <d 1 . . \ . -nc scales 

13. " i The system of claim 1 wherein the connection sub-iables include . n- 

v.ncv iHw u a . ■) s vsou s 1 m 1 n j \i u v.s .v. v m m, 
<x < es on a larger i no than time she* ib tat e with i 

ecords rece II co ^ f . m >ectb his of tit 



A a c\:^ - ^ x . ><„ -s^npriaes; 




, N iuk i x 1 !k p e< I oT aiM 

cod l ectiPa, statisti cal information in the coilcctor dgvicea to send to me a^rega.or device. 



o 1 > ! • t \u tMi ! 

detcnTprunc occurrences ot'nclwork anom alies: arid 

mi , e i i , 1 v , 1 * : 

pe'wmk c\u<ts m as mvKW- 

17. (Original) The method of claim 14 wherein the counsel ion tabic includes a plurality 



1 8. (Original) The method of claim 14 wherein the commotio n > includes a phsraluy 
add est. 

m 4 u i > v o ) s i v ' cos a p sral > 

d vM" \ -> > a't. 'ic<>i DV c!W 



dOnc ^ net * c n 14 wherein th , - <> , ! % . ,N 

of coords thai are Inured in scarce address, destination ado s and lime. 
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2 (Or i > sin 14 vri ereh; tht s. os. • t 1 ^ riura 

of connection sub-tables to track data at different time scales. 

22 ?Oi « ,n ;j fhc netfox cki s t . < ; . > , <\ 1 „ 

K ill >{ * { i L hi 

operates on a larger unit of time than the tone slice sub-table with each sub-table holding the sum 
fre< dare maiicolk > during i sp ctive units of time 

23. (Original) A method of detecting a new host cornice to g \ et on cot )pt sc s 

t ! Li * e ! t >s i U uu > ed 

indicating to a console thai the host is i new host if during a period of time T, the host 

f > s J L t t\is v } { 

raid received, more than N packets in any previous period of time with a duration of T. 

-4. « v < U! i j u f u a , 
failed host in a network comprises: 

dv^-i i o s i huL .a! aitv ^ xeises ^noa^e 

packets front a host ; g; raer ihanM[i,]}and aratiOO! ^ >\t a o,- > \ . oMu, 0 ; <, .d 

N a , a >^ * , L ,he» ptobki ! ' h x , e u i vb 

v ^ !ca> > « \ > > i\i oj time; and 

i lu a i! haled hesi u'both conda;< U 



